diff --git a/towncrier/newsfragments/3851.misc b/towncrier/newsfragments/3851.misc
new file mode 100644
index 00000000..61f3eb9a
--- /dev/null
+++ b/towncrier/newsfragments/3851.misc
@@ -0,0 +1 @@
+Upgrade roundcube to 1.6.11. For the record, Mailu is not vulnerable to CVE-2025-49113, thanks to Snuffleupagus (see https://snuffleupagus.readthedocs.io/config.html#unserialize-noclass)